Quantum Zero-Error Algorithms Cannot be Composed* 



Harry Buhrman 
CWI and U. of Amsterdam 
buhrman@cwi . ni 



Ronald de Wolf 

CWI 
rdewolf @cwi .nl 



Abstract 



We exhibit two black-box problems, both of which have an efficient quantum algorithm with 
zero-error, yet whose composition does not have an efficient quantum algorithm with zero-error. 
This shows that quantum zero-error algorithms cannot be composed. In oracle terms, we give 
a relativized world where ZQP Z< ^ P ^ ZQP, while classically we always have ZPP ZPP = ZPP. 

Keywords: Analysis of algorithms. Quantum computing. Zero-error computation. 

1 Introduction 

We can define a "zero-error" algorithm of complexity T in two different but essentially equivalent 
ways: either as an algorithm that always outputs the correct value with expected complexity T 
(expectation taken over the internal randomness of the algorithm), or as an algorithm that outputs 
the correct value with probability at least 1/2, never outputs an incorrect value, and runs in worst- 
case complexity T. Expectation is linear, so we can compose two classical algorithms that have 
an efficient expected complexity to get another algorithm with efficient expected complexity. If 
algorithm A uses an expected number of a applications of B and an expected number of a! other 
operations, then using a subroutine for B that has an expected number of b operations gives A an 
expected number of a ■ b + a! operations. In terms of complexity classes, we have 



where ZPP is the class of problems that can be solved by a polynomial-time classical zero-error 
algorithm. This equality clearly relatives, i.e., it holds relative to any oracle A. 

In this paper we show that this seemingly obvious composition fact does not hold in the quantum 
world. We exhibit black-box (query complexity) problems g and h that are both easy to quantum 
compute in the expected sense, yet whose composition / = g(h, . . . , h) requires a very large expected 
number of queries. In complexity terms, we exhibit an oracle A where 



where ZQP is the class of problems that can be solved by a polynomial-time quantum zero-error 
algorithm. This result is somewhat surprising, because exact quantum algorithms can easily be 
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composed, and so can bounded-error quantum algorithms. Moreover, it is also easy to use a 
quantum zero-error algorithm as a subroutine in a classical zero-error algorithm. That is 

E QpEQP = E Qp and B QpBQP = gQp and Z ppZQP = z q P) 

relativized as well as unrelativized. 

2 Preliminaries 

We assume familiarity with computational complexity theory [2j and quantum computing jSj. In 
this section we briefly introduce the "modes of computation" that we are considering. Let / be 
some (possibly partial) Boolean function with set of inputs X = Xq U X\, where J(Xq) = and 
f{X\) = 1. Let Pb(x) be the probability that algorithm A outputs bit b on input x. We define four 
modes of computation: 

1. A is an exact algorithm for / if P\{x) = 1 for all x € X\ and Pq(x) = 1 for all x £ Xq 

2. A is a zero-error algorithm for / if P\{x) > 1/2 and Pq{x) = for all x € X\ (assume there 
is a third possible output "don't know"), and Pq(x) > 1/2 and P±(x) = for all x E Xq 

3. A is a bounded-error algorithm for / if P\{x) > 2/3 for all x £ Xi, and Pq(x) > 2/3 for all 

x e x 

4. A is a nondeterminístic algorithm for / if P\{x) > for all x G X\, and P\{x) = for all 
x G Xq 

Note that an exact algorithm is a zero-error algorithm, and a zero-error algorithm is a bounded-error 
algorithm as well as a non-deterministic algorithm. 

In the setting of query complexity, f is an iV-bit Boolean function, so X UX 1 Ç {0, 1}^. We 
can only access the input x € {0, 1}^ by making queries to its bits. A query is the application of 
the unitary transformation O x that maps 

O x : \i,b,z) i— > \i, b ® Xi, z), 

where i G [N] and b £ {0, 1}. The z-part corresponds to the workspace, which is not affected by 
the query. A T-query quantum algorithm has the form A = UtO x Ut-i • • • O x XJ\O x Uq, where the 
Uk are fixed unitary transformations independent of x. The final state A|0) depends on x via the 
T applications of O x . The output of the algorithm is determined by measuring the two rightmost 
qubits of the final state. Let's say that if the rightmost bit is 1 then the algorithm claims ignorance 
("don't know"), and if it is then the next-to-rightmost bit is the output bit. We refer to the 
survey [Hj for more details about classical and quantum query complexity. 

We will use Qe(Í), Qo(f), Q2(f), NQ(f) to denote the minimal query complexity of a quantum 
algorithm for / in the four above modes, respectively. Accordingly, Qe(Í) is the exact quantum 
query complexity of /, Qo(f) is zero-error quantum query complexity, Q2(f) is bounded-error 
quantum query complexity, and NQ(f) is nondeterministic quantum query complexity. Note that 
by definition we immediately have 

Q 2 (/) < Qo(f) < QeU) and NQ(f) < Q (f) < Q E (f). 
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Our proofs will use the close connection between quantum query complexity and polynomials 2 . 
An A^-variate multilinear polynomial p is a function of the form p(x) = X^sc[tv] a sxs, where as 
is real and xs = X\í & s x í- Its degree deg(p) = maxjlS'l : as ^ 0} is the largest degree among its 
monomials. The next lemma connects nondeterministic complexity with polynomials: 

Lemma 1 The nondeterministic quantum query complexity NQ(f) of f equals the minimal degree 
among all multilinear polynomials p such that 

1. p(x) 7^ for all x £ X\ 

2. p(x) = for all x G Af 

This lemma improves the query complexity lower bound by a factor of 2, compared to the 
"standard" polynomial method |2j. 

The setting of computational complexity can be defined either in terms of Turing machines or of 
uniform circuit families. Here we define EQP, ZQP, BQP, and NQP to be the classes of languages 
for which there exist polynomial-time quantum algorithms in the above four modes, respectively. 
We restrict attention to algebraic amplitudes for these classes. 

For example, NQP ("quantum NP") is taken to be the class of languages L for which there exists 
an efHcient quantum algorithm that has positive acceptance probability on input x iSx G L pQ. This 
class was shown to be equal to the classical counting class coC=P jSJ ■ There is an alternative 
definition of quantum NP based on verification of quantum certificates Chapter 14] which we 
will not discuss here. We similar ly define the classes EQP" 4 , etc, when we have access to an oracle 
A for some language, and EQP S = LUgsEQP" 4 , etc, when S is a set of oracles. By definition we 
immediately have 

EQP Ç ZQP Ç BQP and EQP Ç ZQP Ç NQP, 
and these inclusions also hold relative to any oracle A. 



3 The problem 

Let m and n be even numbers. We first define the partial Boolean functions g on n bits and h on 
2m bits, and then their composition / on N = 2mn bits. 

The function g is just the constant vs. balanced problem of Deutsch and Jozsa 4 . Using w(x) 
to denote the Hamming weight of x G {0, l} n , we define: 

{1, if w(x) = (constant) 

0, if w(x) = n/2 (balanced) 

undefined otherwise 

It is well known that there exists an exact 1-query quantum algorithm for this problem 0], while 
any classical deterministic or even zero-error algorithm needs n/2 + 1 queries. 
The function h is a zero-error sampling problem. Let 

Ai = {0 m x : x G {0, l} m , m/2 < w(x) < m} 
Aq = {x0 m : x G {0, l} m , m/2 < w(x) < m} 

(1, if x G .Ai 

0, if x G Ao 

undefined otherwise 
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Clearly h has a classical algorithm that always outputs the correct answer and whose expected 
number of queries is small. The algorithm just queries a random point in the first m bits of its 
input and one in the second m bits, and outputs where it finds a 1 (if it does so). With probability 
> 1/2 it will indeed find a 1, so the expected number of repetitions before termination is < 2. 

Let / on 2mn bits be the partial Boolean function that is the composition of g and h. In other 
words, defining the set of promise inputs by 

X\ = Ao x ■ ■ ■ x Ao 

* v ' 

n times 

X = \J{A V1 x • • • x A yn : y = yi . . . y n G {0, l} n , w(y) = n/2} 

we have 

{1, if x G X\ (constant) 

0, if x G Xq (balanced) 

undefined otherwise 

For later reference, we will give names to the various parts of the 2mn-bit input x: 

input for g 

, * 

input for h input for h input for h 

r _ (0,1) (1,1) (0,2) (1,2) (0,n) (l,n) 

mbits mbits mbits mbits mbits mbits 

In words, / contains n different /i-functions, each with its own 2m-bit input. Here x^ '^ and x^ 1 '^ 
are two m-bit strings that together constitute the input to the ith /i-function. The promise says 
that the 2m-bit input x^ '^ x^ 1 ' 1 ^ always lies in Ao or Ai. The n bits hix^^'x^'^), i = 1, . . . ,n, 
coming out of the n /i-functions are then plugged into g to give the value for /. The promise says 
that these n bits are either all (constant) or half and half 1 (balanced). 

Our function / is just the composition of the problems g and h, each of which needs just a small 
expected number of queries. Yet below we will show that any quantum zero-error algorithm for / 
will need to make many queries. Even stronger, also a nondetermínistíc quantum algorithm for / 
requires many queries. 



4 Lower bound for quantum zero-error algorithms 

The next lemma is our main technical tool: 

Lemma 2 Let p be a 2mn-varíate multilínear polynomial such that 

1. p(x) ^ for all x G X\ 

2. p(x) = for all x G X 
Then deg(p) > min(n/2,m/2) + 1. 

Proof. We use the names for the various subparts of the 2mn-bit input that we introduced in 
Section El We assume without loss of generality that for every i G [n] and every non-zero monomial 
asxs in p, the set S does not simultaneously contain variables from x^ ' 1 ^ and from a^ 1 '^. Since the 
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promise on the inputs sets either x^' 1 ^ or x^ 1 ' 1 ' 1 to m , a monomial containing variables from both 
x (o,i) anc i ^í 1 -*) evaluates to anyway, so removing it from p will not affect the two properties of p. 

Suppose, by way of contradiction, that d = deg{p) < min(n/2, m/2). By the first property of 
the lemma, p cannot be identically zero, so it has to contain at least one monomial. Consider a 
monomial M = asxs in p with maximal degree, so |<S| = d. Consider some i € [n] such that S 
contains variables from x^ 1 '^ (and hence, by the above assumption, no variables from x^ '^). We 
now fix x(°^ to m and fix all non-S variables in > 1 ' to 1. Since there are at most m/2 5-variables 
in total, this already sets at least m/2 bits in x^ ' l > to 1. Accordingly, we have xQdxW G Ai 
for every setting of the S- variables. This forces the ith /i-function to value 1, without fixing the 
S"- variables. Similarly we force the other /i-functions whose variables intersect with S: if S has 
variables from then we force the jth /i-function to 1, and if S has variables from then 

we force it to 0. Since \S\ < n/2, this forces at most n/2 of the /i-functions. Accordingly, we can 
extend our setting to the other /i-functions (whose variables don't intersect with S at all) to create 
a setting of the overall 2mn-bit input that is in Xq (balanced), without fixing the S- variables. 

Let q be the remaining polynomial in the d S"- variables. No matter how we vary the 5-variables, 
the overall input to p remains in Xq (balanced). Hence q must be zero on all Boolean settings of 
its variables. It is easy to see that the only polynomial satisfying this constraint is the one without 
any monomials. But q still contains the monomial M, because being of degree d, M cannot cancel 
against other monomials when we fix the non-S variables. This is a contradiction. □ 

This lemma is exactly tight. First, there is a polynomial with the above properties of degree 
n/2 + 1. For T a set of n/2 + 1 variables, each from a different x^^, define qT to be the degree- 
(n/2 + 1) polynomial that is the AND of these variables. If x £ Xq then qT will be for all T, 
and if x G X\ then for at least one T we have qx = 1. Hence summing qx over all such T gives a 
polynomial p of degree n/2 + 1 such that p(x) = for x € Xq and p{x) > for x € X\. 

Second, there also is an appropriate polynomial of degree m/2+1. Let qi be the degree- (m/2+1) 
polynomial that is the OR of the first m/2 + 1 bits of x^ 1 '^. Then Qj = 1 if x^^'x^'^ E Ai and 
qi = if x^'^x^ 1 '^ € Aq- Defining p to be the degree- (m/ 2 + 1) polynomial n/2 — Yl7=l we nave 
p(x) = for x € Xq and p(x) = n/2 for x G X\. 

Combining the previous lemma with Lemma ngi ves ° ur main theorem: 

Theorem 1 NQ(f) = min(n/2,m/2) + l. 

Since nondeterministic query complexity lower bounds zero-error complexity, we also obtain the 
zero-error lower bound Qo(f) > min(n/2, m/2) + 1. The best upper bound on Qo(f) that we know, 
is min(2n, m) so the lower bound is tight up to small constant factors. First, we know there is a 
classical zero-error algorithm that computes an /i-function using an expected number of 2 queries; 
we can use this to compute the first n/2 /i-functions in an expected number of n queries, which 
suffices to compute /. Terminating this algorithm after 2n steps gives us an algorithm that finds 
the correct output with probability > 1/2 (Markov's inequality), and claims ignorance otherwise. 

Second, there exists an exact quantum algorithm for / that uses m queries. By querying the 
first m/2 bits in an h- input we can decide whether that h takes value or 1. By copying the output 
and reversing the computation we can do this exact computation cleanly (resetting all workspace 
to 0) using m queries. Putting the Deutsch-Jozsa algorithm on top of this gives an m-query exact 
quantum algorithm for /. 

Using a Standard translation of query complexity results to oracles, we obtain 
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Theorem 2 There exists an oracle A such that 

EQP zppA % NQP A , 

hence in particular 

Z QpZQP A g Z QpA 

Proof. For a set A Ç {0,1}*, we use A =n to denote the set of all n-bit strings in A, and we 
identify this with its 2 n -bit characteristic vector. We will construct a set A such that, for every n 
where 2 n = 2m 2 for some m (i.e. for every odd n), A =n is a vàlid input to / (word of warning: the 
'n' used here is not the 'n' used earlier, but the 'm' is; the input length of / is now 2m 2 ). This A 
induces a language 

L = {0 n | 2 n = 2m 2 for some m and /(A =n ) = 1}. 

Let Mi,AÍ2, ... be an enumeration of all oracle NQP-machines, with increasing polynomial time 
bounds (say, Mi has time bound Pi(n) = ri 1 + i). Such an enumeration exists because we can 
assume without loss of generality that the machines only use algebraic amplitudes 03 E] • At 
the start of our construction, A is the empty set. Going along i = 1, 2, . . ., for each Mj we will pick 
a specific input length and define A =Ui in such a way that M A will err on ni , and hence it will 
not accept L. 

Consider M». Its running time is bounded by the polynomial Pi(n) in the input length. Let nj 
be the smallest input length such that (1) 2 Ui = 2m? for some m, (2) pi{nï) < m/2, and (3) raj is 
so large that for all j < i we have Pj(nj) < n^} Since M, makes at most p(nj) < m/2 + 1 = NQ(f) 
queries to the bits of x = A =rbi , Theorem ^imphes that Mj cannot be a nondeterministic algorithm 
for /. Hence there exists some x G Ao U X\ where Mj errs: either x £ Xq while Mi has positive 
acceptance probability when A =n = x; or x E Afí while Mj has zero acceptance probability when 
i =n,i = x. Define A =rii to be that x. This ensures that M A does not accept L. 

Doing this for all Mj and filling the yet-undefined levels A =n by arbitrary promise-inputs to /, 
we now have a language L that is accepted by none of the M A , hence L NQP A . On the other 
hand, the Deutsch-Jozsa algorithm implies L E EQP ZPP , so we have our separation. □ 

5 Conclusion 

We proved that the composition of two problems that are easy for zero-error quantum computing 
need not be easy itself. This contrasts strongly with the case of classical algorithms, and shows 
that our classical intuition about expected running time does not carry over very well to quantum 
algorithms. The problem in using a zero-error algorithm as a subroutine in a quantum algorithm 
seems to be that we cannot reverse the computation to obtain an answer without additional non- 
zero workspace. This remaining non-zero workspace then messes up later quantum interference 
in the main program. Being able to compose zero-error algorithms is a desirable property that 
obviously holds in the classical world. Unfortunately, this property does not hold in the quantum 
world. 

lr This third condition ensures that when we define A =ni to thwart Mi, the behavior of earlier MjS on input length 
rij won't be changed (because Mj on input length rij doesn't have enough time to query strings of length m). 
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